DESTIN SOLUTIONS LTD

Enlight

Enlight is an online procedure manual designed to consolidate regulatory information, policy documents, guidance manuals, forms and more all in one place. Providing council tax, non-domestic rates and benefits staff with easy access to the relevant information they require to get the job done quickly and efficiently.

Features

• Instant updates on department regulations
• Links to the relevant and most up-to-date circulars
• Access to DWP and HMRC Guidance Manuals
• Access to Council specific process and procedures
• Google-like search engine for instant and direct access to content
• New data and information can be easily and securely uploaded
• Manuals hosted in secure web portal and branded as required
• Quick, easy navigation with familiar headings, content, glossaries, indexes
• Manual designed to meet bespoke requirements of each Council
• Alert and news update functionality

Benefits

• Instant access to all the information needed in one place
• Automatic updates on the latest legislation impacting your team
• Reduces staffing errors and internal requests for information
• Create staffing bulletins with focus areas for the week ahead
• Staff confidence in the accuracy of the information you hold
• Provides business continuity, no one person has all the information
• Reduce time wasted searching for data
• Improves knowledge transfer and mentoring of new staff
• Assists with internal audits and compliance - provides visibility
• Promotes a culture of self-learning

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at duncan.baxter@destin.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

512830583104544

Contact

Duncan Baxter
01772 842092
duncan.baxter@destin.co.uk

About your service

• Service categories:

  Applications

  Content workflow and management

  Content services

  • Content Sharing and Collaboration Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: None.
• System requirements: None.

User support

• Email or online ticketing support: Yes
• Support response times: Email support is offered and depending on the priority level of the support required response times will vary between 30 minutes and 2 hours. Response times are different at weekends and can range between 4 to 8 hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: Support is included in the cost of the system and provided through a technical account manager.; ; Destin Solutions provide telephone support during normal office hours (9:00am to 5:00pm – Monday to Friday). Email support is also provided both during and out of office hours.; ; The initial point of referring an incident is via telephone to the appointed Account Manager. All calls are logged and immediately directed to an appropriate technical representative. Destin Solutions will respond to the initial contact within 1 hour and will attempt to resolve the issue within 2 hours.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: A full service on-boarding process is rolled out, when a new client is signed up. A trainer will be provided and use a 'train the trainer' approach so new users can be on-boarded quickly by the Council, long after the solution has been implemented. The client can set up their own users for the solution and manage their own user accounts, assigning different access levels dependent on role. We recommend the client appoints their own system administrator early on in the on-boarding process.; The solution also includes a web based user guide, which is accessible within the web portal.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Typically the data provided to customers by our solution is an exact copy of data held by the customers themselves. However if the client wants to capture additional information such as metadata associated with that information, Destin Solutions can manually extract and provide that data at an additional cost.
• End-of-contract process: At the end of the contract all customer data is immediately removed from Destin Solutions servers. All data stored by authorities is stored on logical drives which at contract termination can be erased using the following algorithms: DOD5220M/ CESG HMG, NIST 800-88.; ; Costs associated with data deletion are based on an hourly rate of £100 per hour.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Our mobile service offers optimised viewing experiences across different mobile platforms however all functionality offered within the desktop service is also available on the mobile service.
• Service interface: Yes
• User support accessibility: EN 301 549
• Description of service interface: SharePoint front end is used to provide presentation and management interfaces for the service via the web.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: None at this stage.
• API: No
• Customisation available: Yes
• Description of customisation: Customisations can be carried out by Destin Solutions on behalf of the client, the user's themselves cannot customise the service. The solution can also be customised to suit a clients branding and logo requirements and guidelines.

Scaling

• Independence of resources: Response times of different users are continuously monitored and if they go above certain parameters during normal use of the system, resources will be increased to reduce this back down to acceptable levels.; ; The system is also designed to prevent "queries of death" from being run, in any case, memory and CPU use of queries being run are continuously monitored so that if a query is hogging resources it can be shut down.

Analytics

• Service usage metrics: Yes
• Metrics types: User administrators can monitor the following metrics on usage:; • Total visits; • Total Pages viewed; • Total Bytes Downloaded; ; These are summarised by Month, Week, Day and by User.
• Reporting types: Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: All electronic transfers of data must be carried out using an encrypted channel. In normal operation, customers are expected to provide sensitive data electronically using agreed protocols. Destin Solutions provide a FTPS server secured with a GlobalSign SSL certificate for this purpose which meets Advanced Encryption Standards. We are also flexible enough to apply other secure methods which the Council may already be using subject to them meeting our criteria.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PSV
• Data import formats:
  • CSV
  • Other
• Other data import formats: PSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The service is available 9:00am to 6:00pm Monday to Friday. Between these core working hours stated, availability of service is 99.99%.; ; Planned upgrade and support work is always carried out, outside of core working hours to minimise the impact on service availability
• Approach to resilience: Available on request.
• Outage reporting: Service outages are reported by email alert.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Accounts given to staff should only have access to the minimum information and resources that are necessary for their job role. Members of staff which from time-time need to perform operations with elevated permissions will be provided with one or more elevated accounts to be used only when necessary to perform those tasks.; ; High privilege accounts must only be used when accounts of lower rights will not perform the tasks required.; ; Log management software is used to audit access to critical systems and detect inappropriate or suspicious access-related events including use of high privilege accounts.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Ultimate responsibility for information security rests with the Managing Director of Destin Solutions, but on a day-to-day basis the Data Security Manager is responsible for implementing the policy and related procedures.; ; Line Managers are responsible for ensuring that their permanent/ temporary staff and contractors are aware of:-; - The information security policies applicable in their work areas; - Their personal responsibilities for information security; - How to access advice on information security matters; ; All staff shall comply with information security procedures including the maintenance of data confidentiality and data integrity. Failure to do so may result in disciplinary action.; ; Line managers are individually responsible for the security of their physical environments where information is processed or stored. Each staff member is responsible for the operational security of the information systems they use.; ; Each system user shall comply with the security requirements that are currently in force, and shall ensure the confidentiality, integrity and availability of the information they use is maintained to the highest standard.; ; Contracts with external contractors allowing access to the organisation’s information systems are in operation before access is allowed. These contracts ensure that staff or sub-contractors of the external organisation comply with all appropriate security policies.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We use a continuous integration methodology with respect to development and as such have a fully automated and reproducible build and test cycle. Changes to system components are checked into our configuration management system and developers test their changes on a local build environment which mirrors the production build environment. If the build is successful then the changes are incorporated into the continuous integration build. Part of the automated test scripts also ensure the security of the system by simulating the effects of users with different access levels running queries against the system.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Windows Server Update Services (WSUS) is used to manage the patching of all the machines and configured to download the latest patches and updates for all components of the solution. WSUS also enables implementation and automation of a patch release strategy and allows us to monitor the number of machines a patch has been deployed to. We monitor relevant forums and official releases about any potential problems with the patch. If none are noted WSUS is updated to approve the patch to the appropriate servers during the next release cycle.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Our networks are protected by Intrusion Protection Systems (IPS) to identify, block and log the following common network attacks:; • Ping of Death; • IP half scan; • Port Scan; • Ping of Death; • Land; • DNS attacks; ; Our IPS is configured to scan and drop IP packets that contain IP options that are indicative of suspicious and potentially malicious behaviour.; ; We use Dell Intrust log management software which enables real-time notification of critical events through email alerts and automatic responses to certain events such as disabling a user account. Response times depend on priority level.
• Incident management type: Supplier-defined controls
• Incident management approach: We use an incident management process flow chart. Users report incidents by phone, email or the portal interface. Incidents are then identified, logged, categorised and prioritised. Following incident diagnosis and resolution incidents are closed subject to users agreeing to the closure. Incidents are fully documented and an incident record is kept. Incident reports are available to customers whom have been impacted by the incident on request, via email, and typically outline the information detailed above.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 20%
• Between £250,000 and £500,000: 20%
• Between £500,001 and £1,000,000: 20%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: CDL Group Ltd
• ISO/IEC 27001 accreditation date: Friday 7 February 2025
• What the ISO/IEC 27001 doesn’t cover: Our registered business address office.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Working conditions which promote an inclusive working environment and promote retention and progression

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at duncan.baxter@destin.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.